...edit the class generated by SOAP::WSDL, and supply the credentials in the proxy = e.g. http://user:password@service.

Maybe call the same get_basic_credentials() routine from there that the transport layer would call (if it did get 401), instead of hardcoding the credentials. The idea being that the credentials would then be stored in the same place they'd be stored otherwise if the 401 or 407 mechanism did work...  (in case I've understood the problem correctly, that is :)

I'm not quite sure how I'd get the opportunity to do that. Plus, if I understand you correctly, I'd be calling my own routine and returning the credentials to myself, not LWP::UserAgent.

OK, I've found a hokey solution (where My::Interface is the interface class generated by SOAP::WSDL):

my $service = My::Interface->new;
my $endpoint = $service->get_endpoint;
$endpoint =~ s!://!://$user:$pass@!;
$service->proxy($endpoint);
[download]

This inserts "$user:$pass@" after the "http(s)://". It's not nice, but it works in this instance, but it could be a bit brittle ...

{   # a block just to scope "no warnings"
    no warnings qw(redefine);

    *LWP::UserAgent::get_basic_credentials = sub {
        my ($user, $password);
        # remove user from option if called, to force prompting for a 
+user
        # name the next time
        print "URL requires authorization.\n";
        if (not $user = delete $opt{user}) {
            print 'User name:';
            ReadMode 1;
            $user =  ReadLine();
            ReadMode 0;
            chomp $user;
        };
        if (not $password = delete $opt{password}) {
            print 'Password:';
            ReadMode 2;
            $password = ReadLine;
            ReadMode 0;
            chomp $password;
        };
        return ($user, $password);
    };
}
[download]

While monkeypatching LWP works, I prefer to derive a class from LWP::UserAgent that implements get_basic_credentials so it's possible to have connections to more than one server and to avoid interference with other modules using LWP::UserAgent.

That is generally the way to do things, but author of wsdl2perl.pl is author of SOAP::WSDL, and my guess is he might know something we don't.

Unfortunately, I don't think that helps me. The SOAP library would still call LWP, not my derived class.

wsdl2perl.pl is what I used to generate the classes. I think the code you quoted is to read a WSDL file that is protected. Anyway, it would still have the same problem, since the code I quoted in the OP does pretty much the same thing ... providing a method to get called when challenged for authentication details (since LWP is used under the covers anyway). If LWP doesn't get a 401 HTTP response code, it won't send the authentication details